Testing Noninterference, Quickly Cat˘ alin˘ Hrit¸cu1 John Hughes2 Benjamin C. Pierce1 Antal Spector-Zabusky1 Dimitrios Vytiniotis3 Arthur Azevedo de Amorim1 Leonidas Lampropoulos1 1University of Pennsylvania 2Chalmers University 3Microsoft Research Abstract To answer this question, we take as a case study the task of Information-flow control mechanisms are difficult to design and extending a simple abstract stack-and-pointer machine to track dy- labor intensive to prove correct. To reduce the time wasted on namic information flow and enforce termination-insensitive nonin- proof attempts doomed to fail due to broken definitions, we ad- terference [23]. Although our machine is simple, this exercise is vocate modern random testing techniques for finding counterexam- both nontrivial and novel. While simpler notions of dynamic taint ples during the design process. We show how to use QuickCheck, tracking are well studied for both high- and low-level languages, a property-based random-testing tool, to guide the design of a sim- it has only recently been shown [1, 24] that dynamic checks are ple information-flow abstract machine. We find that both sophis- capable of soundly enforcing strong security properties. Moreover, ticated strategies for generating well-distributed random programs sound dynamic IFC has been studied only in the context of lambda- and readily falsifiable formulations of noninterference properties calculi [1, 16, 25] and While programs [24]; the unstructured con- are critically important. We propose several approaches and eval- trol flow of a low-level machine poses additional challenges. (Test- uate their effectiveness on a collection of injected bugs of varying ing of static IFC mechanisms is left as future work.) subtlety. We also present an effective technique for shrinking large We show how QuickCheck [9], a popular property-based testing counterexamples to minimal, easily comprehensible ones. Taken tool, can be used to formulate and test noninterference properties together, our best methods enable us to quickly and automatically of our abstract machine, quickly find a variety of missing-taint and generate simple counterexamples for all these bugs. missing-exception bugs, and incrementally guide the design of a correct version of the machine. One significant challenge is that Categories and Subject Descriptors D.2.5 [Testing and Debug- both the strategy for generating random programs and the precise ging]: Testing tools (e.g., data generators, coverage testing); D.4.6 formulation of the noninterference property have a dramatic im- [Security and Protection]: Information flow controls pact on the time required to discover bugs; we benchmark several variations of each to identify the most effective choices. In particu- General Terms Security, Languages, Design lar, we observe that checking the unwinding conditions [14] of our Keywords random testing; security; design; dynamic information- noninterference property can be much more effective than directly flow control; noninterference; abstract machine; QuickCheck testing the original property. Our results should be of interest both to researchers in language- based security, who can now add random testing to their tools for 1. Introduction debugging subtle enforcement mechanisms; and to the random- Secure information-flow control (IFC) is nearly impossible to testing community, where our techniques for generating and shrink- achieve by careful design alone. The mechanisms involved are ing random programs may be useful for checking other properties intricate and easy to get wrong: static type systems must impose of abstract machines. Our primary contributions are: (1) a demon- numerous constraints that interact with other typing rules in subtle stration of the effectiveness of random testing for discovering coun- ways, while dynamic mechanisms must appropriately propagate terexamples to noninterference in a low-level information-flow ma- taints and raise security exceptions when necessary. This intricacy chine; (2) a range of program generation strategies for finding such makes it hard to be confident in the correctness of such mechanisms counterexamples; (3) an empirical comparison of how effective without detailed proofs; however, carrying out these proofs while combinations of these strategies and formulations of noninterfer- designing the mechanisms can be an exercise in frustration, with ence are in finding counterexamples; and (4) an effective methodol- a great deal of time spent attempting to verify broken definitions! ogy for shrinking large counterexamples to smaller, more readable The question we address in this paper is: Can we use modern test- ones. Our information-flow abstract machine, while simple, is also ing techniques to discover bugs in IFC enforcement mechanisms novel, and may be a useful artifact for further research. quickly and effectively? If so, then we can use testing to catch most errors during the design phase, postponing proof attempts until we are reasonably confident that the design is correct. 2. Basic IFC We begin by introducing the core of our abstract machine. In x5 we Permission to make digital or hard copies of all or part of this work for personal or will extend this simple core with control flow (jumps and procedure classroom use is granted without fee provided that copies are not made or distributed calls), but the presence of pointers already raises opportunities for for profit or commercial advantage and that copies bear this notice and the full citation some subtle mistakes in information-flow control. on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or We write [] for the empty list and x : s for the list whose first republish, to post on servers or to redistribute to lists, requires prior specific permission element is x and whose tail is s; we also write [x0; x1; : : : ; xn] for and/or a fee. Request permissions from [email protected]. the list x0 : x1 : ··· : xn :[]. If l is a list and 0 ≤ j < jlj, then ICFP ’13, September 25–27, 2013, Boston, MA, USA. l(j) selects the jth element of l and lfj 7! xg produces the list that Copyright is held by the owner/author(s). Publication rights licensed to ACM. is like l except that the jth element is replaced by x. ACM 978-1-4503-2326-0/13/09. $15.00. http://dx.doi.org/10.1145/2500365.2500574 455 Bare machine Our basic machine (without information-flow la- i2 are indistinguishable if they are the same instruction, or if i1 = bels) has seven instructions: Push v1, and i2 = Push v2, and v1 ≈ v2. Two lists (memories, stacks, or instruction memories) l and l are indistinguishable if Instr ::= Push x j Pop j Load j Store j Add j Noop j Halt 1 2 they have the same length and l1(x) ≈ l2(x) for all x such that The x argument to Push is an integer (an immediate constant). 0 ≤ x < jl1j. A machine state S is a 4-tuple consisting of a program counter pc (an integer), a stack s (a list of integers), a memory m (another For machine states we have a choice as to how much of the state list of integers), and an instruction memory i (a list of instructions), we want to consider observable; we choose (somewhat arbitrarily) that the observer can only see the data and instruction memories, written pc s m i . Often, i will be fixed in some context and we but not the stack or the pc. (Other choices would give the observer will write just pc s m for the varying parts of the machine state. either somewhat more power—e.g., we could make the stack and The single-step reduction relation on machine states, written pc observable—or somewhat less—e.g., we could restrict the ob- S ) S0, is straightforward to define; we elide it here, for brevity. server to some designated region of “I/O memory,” or extend the (It is included in a longer version of the paper, available from architecture with I/O instructions and only observe the traces of http://www.crash-safe.org/node/24.) This relation is a par- inputs and outputs.) tial function: it is deterministic, but some machine states don’t step to anything. Such a stuck machine state is said to be halted if 2.2 Definition: Machine states S1 = pc1 s1 m1 i1 and S2 = i(pc) = Halt and failed in all other cases (e.g., if the machine pc2 s2 m2 i2 are indistinguishable with respect to memories, is trying to execute an Add with an empty stack, or if the pc points written S1 ≈mem S2, if m1 ≈ m2 and i1 ≈ i2. outside the bounds of the instruction memory). We write )∗ for the reflexive, transitive closure of ). When S )∗ S0 and S0 is a 2.3 Definition: A machine semantics is end-to-end noninterfering halted state, we write S + S0. with respect to some sets of states Start and End and an indistin- guishability relation ≈, written EENIStart;End;≈, if for any S1;S2 2 Machine with labeled data In a (fine-grained) dynamic IFC sys- Start and H1;H2 2 End such that S1 ≈ S2 and such that S1 + H1 tem [1, 16, 24, 25] security levels (called labels) are attached to and S2 + H2, we have H1 ≈ H2. runtime values and propagated during execution, enforcing the con- straint that information derived from secret data does not leak to We take EENIInit;Halted;≈mem as our baseline security property; untrusted processes or to the public network. Each value is pro- i.e., we only consider executions starting in initial states and ending tected by an individual IFC label representing a security level (e.g., in halted states, and we use indistinguishability with respect to secret or public). We now add labeled data to our simple stack ma- memories.